NAT Gateway across clouds
Managed egress for private subnets - NAT Gateway on AWS and OCI, Azure NAT Gateway, Cloud NAT - with the routes written and the address stable.
4 verified modules, 1 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | NAT Gateways for an Existing VPC, One per Zone, with the Private Routes Written | static-validated |
| Azure | Egress with Enough SNAT Ports to Survive the Afternoon | static-validated |
| Google Cloud | Cloud NAT Gateway | ✓ live-tested |
| Oracle Cloud | A NAT Gateway for an Existing VCN with Its Route Table and a Reserved Address | static-validated |
How to choose
Decide zonal or regional first: AWS and Azure place a gateway in a zone, and a private subnet in another zone pays cross-zone charges to reach it, while Cloud NAT is regional and the OCI gateway serves the whole VCN. Then compare what the address is (reserved or ephemeral), how many ports a source gets before connections are refused, and what the hourly charge is when nothing moves.
When not to use
A NAT gateway is egress only, and it is where the cloud bill hides: per-gigabyte charges on every byte that leaves, including traffic bound for services in the same cloud, which a private endpoint would have carried for less.